Governance Platform Coverage and Gap Doctrine
Model for determining what a governance platform covers and what remains a gap.
Purpose
Not every control or process is delivered by a single platform. This document defines how to classify coverage and how to treat gaps so that residual risk is explicit.
Coverage classification
| Classification | Meaning |
|---|---|
| Covered | The platform enforces the control and produces evidence |
| Partial | The platform supports the control but evidence or enforcement is incomplete |
| Gap | The control is required but not delivered by the platform |
| Out of scope | The control is not required for this boundary or workload |
Gap treatment
- Record the gap in the Gap Closure Register.
- Assign an owner and a residual risk rating.
- Decide: close by configuration, close by compensating control, or accept with approval.
- Define the evidence that will prove the decision was executed.
- Review on the continuous monitoring cadence.
Bottom line
Coverage is not binary. Explicit classification and gap treatment prevent silent residual risk.
Cleaned extraction for project use.